Data Processing Agreement.

This Data Processing Agreement ("DPA") forms part of the Agreement between Flowboost Industries B.V. and the Client and is incorporated by reference into the General Terms and Conditions. Upon its incorporation, it takes precedence over the General Terms and Conditions in respect of data processing matters, in accordance with Article 2.3 of the General Terms and Conditions.

Version: v2026-01
Effective Date: 23 March 2026
Registered: Chamber of Commerce (KvK) No. 90025393, Rotterdam
Governing Law: Dutch law, courts of Rotterdam

Contact:

Flowboost Industries B.V.
Bierstraat 123C, 3011XV Rotterdam, the Netherlands
hello@flowboost.com
+31(0)10 261 3569 (business hours)

Recitals

(A) Flowboost Industries B.V. acts as a Data Processor in respect of Company Personal Data processed by it on behalf of the Client.

(B) The Client acts as the Data Controller in respect of Company Personal Data.

(C) The parties seek to implement a data processing agreement that complies with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR").

(D) The parties wish to lay down their respective rights and obligations in accordance with Article 28 GDPR.

Article 1. Definitions

In this DPA, the following capitalised terms have the meanings set out below. Where a term is used in the singular, it includes the plural and vice versa.

Flowboost / We / Us: Flowboost Industries B.V., a private limited company (besloten vennootschap) incorporated and established in Rotterdam, the Netherlands, registered at the Dutch Chamber of Commerce (KvK) under number 90025393.

Client / You: The natural person or legal entity that enters into an Agreement with Flowboost Industries B.V. for the provision of Services, acting as the Data Controller in respect of Company Personal Data.

Agreement: This Data Processing Agreement, the General Terms and Conditions, any applicable quotation or order confirmation, and all Schedules.

Company Personal Data: Any Personal Data processed by Flowboost Industries B.V. on behalf of the Client pursuant to or in connection with the Agreement.

Data Protection Laws: Means the GDPR and any applicable national implementing legislation, as amended or replaced from time to time.

EEA: European Economic Area

GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

Services: The digital tools, platforms, and services provided by Flowboost Industries B.V. as described in the General Terms and Conditions, including the Library, AI Agents (Wolfy), Tools, Marketing Services, and Portal.

Sub-processor: Any third party appointed by Flowboost Industries B.V. to process Company Personal Data on its behalf in connection with the Agreement.

The terms "Controller", "Data Subject", "Personal Data", "Personal Data Breach", "Processing", "Processor", and "Supervisory Authority" shall have the meanings ascribed to them in the GDPR.

Article 2. Subject Matter, Nature, Purpose and Duration

2.1 Subject Matter.

Flowboost Industries B.V. processes Company Personal Data on behalf of the Client for the purpose of providing the Services as described in this DPA and the Agreement.

2.2 Nature and Purpose.

The nature and purpose of processing, the types of Personal Data, and the categories of Data Subjects are set out in Schedule 1 to this DPA.

2.3 Duration.

Flowboost Industries B.V. shall process Company Personal Data for the duration of the Agreement, unless otherwise agreed in writing or required by applicable law. Upon termination or expiry of the Agreement, Flowboost Industries B.V. shall handle Company Personal Data in accordance with Article 11 of this DPA.

Article 3. Obligations of the Processor

3.1 Flowboost Industries B.V. shall:

(a) process Company Personal Data only on the documented instructions of the Client, unless required to do so by applicable law, in which case Flowboost Industries B.V. shall, to the extent permitted by law, inform the Client of that legal requirement before processing;

(b) ensure that persons authorised to process Company Personal Data are bound by appropriate confidentiality obligations;

(c) implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing, in accordance with Article 32 GDPR and Article 6 of this DPA;

(d) assist the Client in fulfilling its obligations to respond to Data Subject requests under Chapter III of the GDPR, taking into account the nature of the processing;

(e) assist the Client in meeting its obligations under Articles 32 to 36 of the GDPR (security, breach notification, DPIAs, and prior consultation), taking into account the nature of the processing and the information available to Flowboost Industries B.V.;

(f) at the choice of the Client, delete or return all Company Personal Data to the Client upon termination or expiry of the Agreement, and delete existing copies unless retention is required by applicable law;

(g) make available to the Client all information reasonably necessary to demonstrate compliance with this DPA and the obligations set out in Article 28 GDPR; and

(h) notify the Client promptly if, in Flowboost Industries B.V.'s opinion, an instruction from the Client infringes applicable Data Protection Laws.

Article 4. Sub-processors

4.1 General Authorisation.

The Client provides general authorisation to Flowboost Industries B.V. to engage Sub-processors for the purposes of providing the Services. The current list of approved Sub-processors is set out in Schedule 2 to this DPA. An up-to-date list of approved Sub-processors is available to Clients upon written request at hello@flowboost.com.

4.2 New Sub-processors.

Flowboost Industries B.V. may add or replace Sub-processors at any time. An up-to-date list of approved Sub-processors is available upon written request at hello@flowboost.com in accordance with Article 4.1. The Client may object to any Sub-processor in writing at any time. If Flowboost Industries B.V. is unable to accommodate a reasonable, documented objection, the Client may terminate the Agreement or the relevant part of the Services with 30 days' written notice, without penalty.

4.3 Objection.

If the Client raises a reasonable, documented objection to a new Sub-processor and Flowboost Industries B.V. is unable to accommodate that objection, the Client may terminate the Agreement or the relevant part of the Services with 30 days’ written notice, without penalty.

4.4 Sub-processor Obligations.

Flowboost Industries B.V. shall impose data protection obligations on each Sub-processor that are no less protective than those set out in this DPA. Flowboost Industries B.V. remains fully liable to the Client for the performance of each Sub-processor’s obligations.

Article 5. Data Subject Rights

5.1 Assistance with Data Subject Requests.

Flowboost Industries B.V. shall, taking into account the nature of the processing, assist the Client by implementing appropriate technical and organisational measures to enable the Client to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR (including rights of access, rectification, erasure, restriction, portability, and objection).

5.2 Notification of Requests.

Flowboost Industries B.V. shall promptly notify the Client if it receives a Data Subject request in respect of Company Personal Data, and shall not respond to such request except on the documented instructions of the Client, or as required by applicable law.

Article 6. Security Measures

6.1 Technical measures.

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity to the rights and freedoms of natural persons, Flowboost Industries B.V. shall implement and maintain appropriate technical and organisational security measures, including:

(a) encryption of Company Personal Data in transit and at rest;

(b) ongoing confidentiality, integrity, availability, and resilience of processing systems and services;

(c) the ability to restore availability and access to Company Personal Data in a timely manner in the event of a physical or technical incident;

(d) a process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing;

(e) access controls ensuring that Company Personal Data is accessible only to authorised personnel on a need-to-know basis;

(f) pseudonymisation of Company Personal Data where appropriate and reasonably practicable.

6.2 Confidentiality obligations.

Flowboost Industries B.V. shall take reasonable steps to ensure that any staff with access to Company Personal Data are subject to appropriate confidentiality obligations.

6.3 Processing on Documented Instructions.

Flowboost Industries B.V. shall ensure that any staff authorised to process Company Personal Data do so only in accordance with the documented instructions of the Client and the terms of this DPA.

Article 7. Personal Data Breach

7.1 Notification Obligation.

Flowboost Industries B.V. shall notify the Client without undue delay, and in any event within 72 hours of becoming aware, of any Personal Data Breach affecting Company Personal Data.

7.2 Content of Notification.

Such notification shall include, to the extent then available:

(a) a description of the nature of the Personal Data Breach, including where possible the categories and approximate number of Data Subjects affected and records concerned;

(b) the name and contact details of the data protection contact at Flowboost Industries B.V.;

(d) a description of the measures taken or proposed to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.

7.3 Phased Notification.

Where all information required under Article 7.2 is not available at the time of initial notification, Flowboost Industries B.V. shall provide the remaining information in phases without undue delay.

7.4 Cooperation and Remediation.

Flowboost Industries B.V. shall cooperate with the Client and take reasonable steps to assist in the investigation, mitigation, and remediation of any Personal Data Breach. Flowboost Industries B.V. will provide the Client with sufficient information to enable the Client to meet its own notification obligations under applicable Data Protection Laws.

Article 8. Data Protection Impact Assessment

8.1 DPIA Assistance.

Flowboost Industries B.V. shall provide reasonable assistance to the Client with any data protection impact assessments (DPIAs) and prior consultations with Supervisory Authorities or other competent data privacy authorities which the Client reasonably considers to be required under Articles 35 and 36 of the GDPR, in each case solely in relation to the processing of Company Personal Data by Flowboost Industries B.V. and taking into account the nature of the processing and the information available to Flowboost Industries B.V.

8.2 Proactive DPIA Notification.

Where Flowboost Industries B.V. becomes aware that a new processing activity is likely to require a DPIA under Article 35 GDPR, it shall inform the Client accordingly.

Article 9. Audit Rights

9.1 Information and Compliance Evidence.

Flowboost Industries B.V. shall make available to the Client, upon reasonable written request, all information reasonably necessary to demonstrate compliance with the obligations set out in this DPA and Article 28 GDPR.

9.2 Audit and Inspection Rights.

Flowboost Industries B.V. shall allow for and contribute to audits and inspections conducted by the Client or a mandated third-party auditor, provided that:

(a) the Client provides at least 30 days’ prior written notice of any audit;

(b) audits are conducted during normal business hours and in a manner that minimises disruption to Flowboost Industries B.V.’s operations;

(d) the costs of the audit are borne by the Client, unless the audit reveals a material breach of this DPA by Flowboost Industries B.V.

9.3 Certifications as Audit Equivalent.

Flowboost Industries B.V. may satisfy audit obligations in whole or in part by providing relevant security documentation or internal audit reports where available.

Article 10. Data Transfers

10.1 EU Data Residency.

Flowboost Industries B.V. stores and processes Company Personal Data within the European Economic Area (EEA) by default, using infrastructure hosted in the EU (primarily Google Cloud, Netherlands region).

10.2 Transfers Outside the EEA.

Where the use of a Sub-processor requires a transfer of Company Personal Data to a country outside the EEA that does not benefit from an adequacy decision under Article 45 GDPR, Flowboost Industries B.V. shall ensure that such transfer is subject to appropriate safeguards, including:

(a) Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46(2)(c) GDPR; or

(b) any other transfer mechanism recognised as valid under applicable Data Protection Laws.

10.3 Sub-processor Transfer Mechanisms.

The applicable transfer mechanisms for each Sub-processor are set out in Schedule 2.

Article 11. Deletion or Return of Company Personal Data

11.1 Return or Deletion Upon Termination.

Upon termination or expiry of the Agreement, Flowboost Industries B.V. shall, at the Client’s choice:

(a) make Company Personal Data available for export via the Portal for a period of 30 days following termination; and/or

(b) securely delete or anonymise all Company Personal Data within 30 days of the end of the export period.

11.2 Confirmation of Deletion.

Flowboost Industries B.V. shall confirm the completion of deletion in writing upon the Client’s reasonable request, subject to any legally mandated retention obligations.

11.3 Legally Mandated Retention.

Notwithstanding the above, Flowboost Industries B.V. may retain Company Personal Data to the extent required by applicable law (including Dutch fiscal law requiring retention of financial records for seven years), in which case Flowboost Industries B.V. shall ensure that such data is processed only for the purposes required by applicable law and is protected by appropriate security measures.

11.4 Sub-processor Deletion Obligations.

Flowboost Industries B.V. shall ensure that Sub-processors delete or return Company Personal Data in accordance with this Article upon termination of the relevant sub-processing arrangement.

Article 12. General Terms

12.1 Relationship with Agreement.

This DPA forms part of and is subject to the Agreement. In the event of any conflict between this DPA and the General Terms and Conditions in respect of data processing matters, this DPA shall prevail.

12.2 Confidentiality.

Each party shall keep the terms of this DPA and any information received about the other party in connection with it confidential, except to the extent required by applicable law or as necessary to perform obligations under this DPA.

12.3 Liability.

Each party’s liability under this DPA is subject to the limitations and exclusions set out in Article 11 of the General Terms and Conditions, except to the extent that applicable Data Protection Laws impose greater liability.

12.4 Notices.

All notices under this DPA shall be given in accordance with Article 17.4 of the General Terms and Conditions.

12.5 Amendments.

Flowboost Industries B.V. may update this DPA to reflect changes in Data Protection Laws or its processing activities, with at least 30 days’ prior written notice to the Client.

12.6 Governing Law.

This DPA is governed by Dutch law. Any disputes arising in connection with this DPA shall be subject to the exclusive jurisdiction of the District Court of Rotterdam (Rechtbank Rotterdam).

Schedule 1 (Processing Activities) and Schedule 2 (Approved Sub-processors) form part of this DPA and are available upon written request at hello@flowboost.com.